Cyber insurance for a healthcare practice — what HIPAA actually requires you to have.

The short answer

Before you compare carriers, your cyber policy needs to clear three HIPAA-specific checks. A generic cyber policy that doesn't is inadequate for healthcare:

1. HIPAA breach-notification costs covered at full policy limits, not sub-limited
2. OCR (Office for Civil Rights) investigation defense covered at full limits
3. Ransomware sublimit adequate for healthcare exposure (healthcare ransomware demands are typically materially higher than generic SMB cyber)

The carriers that consistently meet these three checks for a typical small-to-mid healthcare practice:

• Chubb — deep paper depth, longest-established HIPAA-aware cyber offering. Modal choice for practices that prioritize claims-handling track record.
• Coalition — bundled security monitoring and incident response, useful for practices without an in-house IT/security team. Modal choice for tech-forward practices.
• Beazley — strong claims-handling reputation for HIPAA breach response. Their Breach Response service is widely-referenced.
• At-Bay — insurtech alternative to Coalition.

Quote 2-3 carriers, match the three HIPAA checks, then optimize for price. Specific premium ranges vary widely — get quotes from a healthcare-aware broker.

2026 update: what changed and why it matters

OCR breach portal — 2025 numbers. HHS OCR logged roughly 709 large healthcare data breaches in 2025 — down about 4.3% year-over-year, but still close to two large breaches per day. The 2025 record of 61.6 million individuals affected looks far better than 2024's all-time high of 289 million, but 2024 was inflated by the Change Healthcare cascade (192.7 million individuals affected by a single February 2024 ransomware attack against UnitedHealth Group's payment clearinghouse). Strip Change Healthcare out of 2024 and 2025 still shows improvement. The OCR Wall of Shame now lists over 7,000 cumulative reported breaches since 2009. Source: HIPAA Journal — 2025 Healthcare Data Breach Report.

Average breach cost: $9.8 million. Healthcare has held the top spot for data breach costs for 14 consecutive years. The IBM Security 2024 Cost of a Data Breach Report puts the average healthcare breach at $9.8 million — roughly 2.5x the global cross-industry mean. For context: attacks on independent provider practices rose 6x since 2021. Source: Patient Protect — Healthcare Data Breach Statistics 2026.

Ransom payment rates keep dropping — but demands keep climbing. Coveware's Q4 2025 report put the ransom payment rate at approximately 20% — a record low, down from the 25–35% range common in earlier years. At the same time, Coalition's 2026 Cyber Claims Report found that initial ransom demands jumped 47% year-over-year, with demands now regularly exceeding $1 million. Coalition also reported that 86% of its policyholders refused to pay in 2025. Not paying is increasingly the industry norm, but it demands good backups and fast recovery. Sources: Coveware — Q4 2025 Ransomware Report; Coalition — 2026 Cyber Claims Report.

Dual extortion is now the standard. Coalition found that 70% of ransomware claims in 2025 involved both encryption and data theft. These dual-extortion claims averaged $302,000 in total cost — twice what encryption-only claims cost. For healthcare, data theft means patient PHI on the dark web regardless of whether you restore from backups. Your cyber policy needs to cover both the recovery cost and the downstream notification and regulatory exposure.

HIPAA Security Rule update. HHS published a Notice of Proposed Rulemaking on January 6, 2025, proposing the first substantive update to the HIPAA Security Rule since 2003. Key proposed changes: mandatory multi-factor authentication (MFA) for access to ePHI systems, explicit alignment with NIST Cybersecurity Framework 2.0, and tightened vendor compliance requirements for business associates. The 180-day implementation window was proposed for smaller entities. Final rule timing is uncertain, but underwriters are already using these benchmarks in application questionnaires. Source: Federal Register — HIPAA Security Rule NPRM, Jan 6 2025.

OFAC compliance is not optional. OFAC maintains sanctions against numerous ransomware actors. Paying a sanctioned threat actor can trigger an OFAC enforcement action independent of any ransom payment decision. Your cyber policy must include: (a) OFAC screening support before any ransom payment, and (b) coverage for fines or legal costs if sanctions compliance is at issue. Your broker should confirm this language is explicit — some policies leave it ambiguous. Source: OFAC — Cyber-Related Sanctions.

Why healthcare cyber is different

Three things make healthcare cyber riskier than generic SMB cyber:

1. HIPAA breach notification. Under the HIPAA Breach Notification Rule, providers must notify affected individuals, the Office for Civil Rights (OCR), and sometimes media for breaches affecting 500+ patients. Notification costs are substantial — your cyber policy needs to specifically cover HIPAA-driven notification (not just generic state-AG notification).

2. OCR investigations. OCR enforces HIPAA against small practices including clinics, dental offices, behavioral health. Settlements and corrective action plans are routine; investigations can run years and require meaningful legal defense spend. Cyber policies should explicitly cover OCR investigation defense at full limits.

3. Healthcare is a top ransomware target. Per CISA and FBI IC3 reports, healthcare is consistently among the most-attacked sectors. In 2025, healthcare accounted for 22% of all confirmed ransomware attacks globally (Black Fog, via HIPAA Journal). Small practices are especially targeted because operational urgency (patient care) makes them more likely to pay quickly.

The three things to verify in any quote

1. HIPAA breach-notification cost coverage.

The right endorsement language: "Notification costs covered up to the policy aggregate, including HIPAA-specific breach notification (written notice, credit monitoring offers, call-center coverage)."

The wrong language: any sub-limit specifically applied to HIPAA notification, or coverage limited to "state-AG notification" without HIPAA reference.

2. OCR investigation defense.

The right endorsement: "Regulatory investigation defense covered up to the policy aggregate, including Office for Civil Rights investigations under HIPAA."

The wrong endorsement: regulatory investigation sub-limited at a small fraction of the policy aggregate. For healthcare, this is structurally inadequate.

3. Ransomware sublimit and OFAC compliance.

Verify the ransomware sublimit matches your practice's exposure (which depends on EHR criticality, telehealth, and patient-data volume). Also verify the policy includes OFAC compliance support for ransom payments — recent enforcement actions have penalized organizations that paid sanctioned threat actors.

What healthcare SMBs actually need

A typical practice insurance program:

• General Liability + Property — Business Owner's Policy (BOP)
• Cyber — separate policy with the three checks above
• Professional Liability (medical malpractice) — separate from cyber
• Employment Practices Liability (EPL) — for practices with employees

Don't try to consolidate cyber into a "medical practice protection package" — combined products typically have lower per-line limits and inadequate HIPAA endorsements.

What to do — in order

1. Inventory your cyber surface. EHR system, billing system, payment processing, telehealth platform, business-associate agreements (BAAs) with vendors. Your cyber policy needs to align — including third-party vendor breach exposure.
2. Quote at least 3 carriers with healthcare-specific endorsements. Coalition + Chubb + one of (Beazley, At-Bay).
3. Use a healthcare-aware broker. Brokers specializing in healthcare professional liability often carry cyber too: Marsh Healthcare, Lockton Healthcare, NSM Insurance Group (specialty wholesale), CRC Insurance Services.
4. Verify the three checks (HIPAA notification, OCR defense, ransomware sublimit) before binding. Get the endorsement language in writing.
5. Match limits to your practice size and exposure. Higher limits for practices handling behavioral health, sensitive populations, or multi-state operations.

Adjacent reading

• Best cyber insurance for a SaaS startup — same coverage, different vertical
• Best cyber insurance for a fintech startup — adjacent vertical
• Best malpractice insurance for therapists — adjacent coverage for healthcare practices